[Privacy] PRIVACY.md implies an image gets the same projection treatment as text #628

New issue

Closed

opened 2026-07-22 16:21:55 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 16:21:55 +00:00

Owner

Found in the pre-publication privacy review. The code here is better than the text, which is the reason to fix it.

Evidence: docs/PRIVACY.md:266-270 — the AI helper sends "only what the task needs: one image for alt-text, or the single finding you are editing … And that text context does not leave as you typed it: it is first run through the same privacy projection every other outbound path uses."

The code says something different, and better: lib/widgets/editors/alt_text_field.dart:111-116 — "Een afbeelding kan niet door de projectie … Zonder dit stuurde één klik een schermafdruk van een beheerpaneel of een groepsfoto naar een derde partij." There is a real safeguard — confirmAiImageOutbound at :118, including a face count — that does not appear in PRIVACY.md at all.

Why this matters now: the paragraph names image and text in one breath and applies the safeguard only to text, so a reader infers the image is equally protected. For a penetration tester the evidence screenshot is the most sensitive thing there is. The per-image confirmation is a selling point going unmentioned.

Proposal: two sentences in the same paragraph: an image cannot pass through the projection (which substitutes characters, and a JPEG has none), and that is why OciDeck asks for confirmation per image, naming the destination and the number of recognisable faces.

Found in the pre-publication privacy review. The code here is better than the text, which is the reason to fix it. **Evidence:** `docs/PRIVACY.md:266-270` — the AI helper sends "only what the task needs: **one image for alt-text**, or the single finding you are editing … And that text context does not leave as you typed it: it is first run through **the same privacy projection every other outbound path uses**." The code says something different, and better: `lib/widgets/editors/alt_text_field.dart:111-116` — "Een afbeelding **kan niet door de projectie** … Zonder dit stuurde één klik een schermafdruk van een beheerpaneel of een groepsfoto naar een derde partij." There is a real safeguard — `confirmAiImageOutbound` at `:118`, including a face count — that does not appear in PRIVACY.md at all. **Why this matters now:** the paragraph names image and text in one breath and applies the safeguard only to text, so a reader infers the image is equally protected. For a penetration tester the evidence screenshot is the most sensitive thing there is. The per-image confirmation is a selling point going unmentioned. **Proposal:** two sentences in the same paragraph: an image cannot pass through the projection (which substitutes characters, and a JPEG has none), and that is why OciDeck asks for confirmation per image, naming the destination and the number of recognisable faces.

brenno added the

docs

privacy

labels

2026-07-22 16:21:55 +00:00

brenno referenced this issue from a commit

2026-07-22 17:01:56 +00:00

docs(privacy): breng vier beloftes terug naar wat de code doet

brenno referenced this issue from a pull request that will close it,

2026-07-22 17:02:16 +00:00

docs(privacy): breng vier beloftes terug naar wat de code doet (#603, #628, #643, #644) #653

brenno closed this issue